Open source

Updated 7 November 2026

Validation engine

The 116 libraries in the validation engine, version 1.0.0, as resolved by its build on 2026-11-05. Each source link is the exact version's source archive; the engine image carries every original licence text and notice. Modules without verified permission for their exact artefacts are deliberately not bundled, and no capability is inferred from their metadata.

LGPL

OpenHTMLtoPDF is LGPL-2.1 or later and is used unmodified; its licence text, notices, exact version and source link accompany the engine image.

MPL

veraPDF is offered under MPL-2.0 or GPL-3.0 or later and Klarbon uses its MPL option; Saxon-HE and Rhino are MPL-2.0. All are used unmodified, which weak copyleft permits for commercial hosting.

Permissive licences

System components

Programs the engine image installs from its distribution and runs beside the Java libraries.

AGPL

Ghostscript is AGPL-3.0, unmodified and run as a separate process for PDF/A-3 conversion; its notices and source obligations are kept, and this is not an exemption for modifying it.

• ghostscript: AGPL-3.0. Unmodified separate executable. Exact distribution version is recorded in the image measurements. Source

GPL with the Classpath Exception

The Java 21 runtime is GPL-2.0 with the Classpath Exception; the exact build is recorded in the engine's image measurements.

• java-runtime: GPL-2.0-with-classpath-exception. Exact runtime build is recorded in the image measurements. Source

Rule sets and schemas

The 43 rule sets and schemas the engine validates files against, each at the exact release it bundles, with its licence tier from the engine's licence policy: open is explicit permissive or EUPL permission, official-unstated an official source used unmodified on the server only. Passing regression tests is not permission to redistribute; available is not a support claim.

EUPL

EUPL rule files are used unmodified with their notices and exact-version source links; any future modification would be published under EUPL, and Klarbon-specific fixes live in a separate layer.

Official sources without a stated licence

Official implementation artefacts for core markets, fetched from the publisher at a pinned revision and checksum during the engine build and used unmodified on the server only; they are never committed, delivered to a browser or bundled. This is a documented risk decision, not a claim that a missing licence grants redistribution rights.

Permissive licences

Official downloads

Files the engine build fetches from their publishers at a pinned address and SHA-256, for the official-source rule sets and the licence texts. They are used only inside the engine image and never committed or delivered to a browser.

Browser and server packages

The 14 npm packages in the code Klarbon distributes or runs: the site's browser scripts, the embed widget, the browser extension and the server. Build tools are not listed except where part of them reaches a bundle. The list is generated from the installed packages and checked against them on every change.